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35-WORD ABSTRACT: 

We describe heavy ion test and simulation results for SEU tolerant latches using three 
configurations of TAG or Guard-Gates implemented in TSMC 0.35 pm process, drawing 
conclusions about required delay lengths and merits of each approach. 
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I. INTRODUCTION 

Design options for decreasing the susceptibility of integrated circuits to Single Event 
Upset (SEU) fall into two categories: (1) increasing the critical charge to cause an upset at a 
particular node, and (2) employing redundancy to mask or correct errors. With decreasing device 
sizes on an Integrated Circuit (IC), the amount of charge required to represent a logic state has 
steadily reduced. Critical charge methods such as increasing 
drive strength or increasing the time required to change state as 
in capacitive or resistive hardening or delay based approaches 
extract a steadily increasing penalty as a percentage of device 
resources and performance. 

Dual redundancy is commonly assumed only to provide 
error detection with Triple Modular Redundancy (TMR) 
required for correction, but less well known methods employ 
dual redundancy to achieve full error correction by voting two 
inputs with a prior state to resolve ambiguity. This requires 
special circuits such as the Whitaker latch [1], or the guard-gate 

[2] which some of us have called a Transition AND Gate (TAG) 

[3] . A 2-input guard gate is shown in Figure 1. It is similar to a _ 

^ J * • i Figure 1: Two input Transition 

Muller Completion Element [4] and relies on capacitance at node A ND gate (tag) or Guard-Gate 

“out” to retain the prior state when inputs disagree, while 
eliminating any output buffer which would be susceptible to radiation strikes. 

This paper experimentally compares delay based and dual rail flip-flop designs wherein 
both types of circuits employ guard-gates to optimize layout and performance, and draws 
conclusions about design criteria and suitability of each option. In both cases a design goal is 
protection against Single Event Transients (SET) in combinational logic as well as SEU in the 
storage elements. For the delay based design, it is also a goal to allow asynchronous clear or 
preset inputs on the storage elements, which are often not available in radiation tolerant designs. 

II. CIRCUITS 

Previous data from a test at 0.5pm indicated that a 3-TAG flip flop [3] as shown in 
Figure 2 was effective in resisting SEUs. This design should also resist SETs originating within 
the combinational logic. Since only a single TAG or guard gate has been proposed to resist SETs 
from combinational logic [2] we investigated whether a 1-TAG flip flop as shown in Figure 3 
would resist SEUs as well as SETs. Input gating circuits are not shown in these figures (see [3] 
or our final paper for details), but since this circuit should suppress SETs originating inside or 
outside the storage cell, asynchronous clear is allowed and was used in these designs. 


Figure 2: Storage cell using three guard gates (input figure 3. Storage cell modified from figure 2 
gating logic not shown!. using one guard gate. 

In order to compare the delay based designs with a dual rail design, we included a 4-TAG 
flip flop (see Figure 4) also tested previously [3], separately proposed as an enhancement to the 
DICE cell [5] and called by some a bias coupled flip flop [6]. 

Delay based flip flops have long been designed without using guard gates. These designs 
require multi-stage delays, usually 3, so a transient arising in a delay stage can be absorbed. 
Similarly, delays have been used with other two input devices such as the Whitaker latch [1] to 












Figure 4: Guard-Gate storage cell using DICE 
configuration (4-TAG latch) 


resist SETs, usually with 5 or more inverters 
[7]. The guard gate allows the use of a 
compact low power two inverter delay [8]. 

Such delays would ordinarily emit 
unacceptably long pulses when themselves 
struck by radiation, but the guard gate 
prevents any SET originating in the delay 
element from ever getting out thus completely 
eliminating the SET. 

The designs were fabricated in the 
TSMC 0.35 pm process using a 51 flip-flop 

test circuit [3]. The delay circuit for 1 and 3 guard-gate designs was constructed to yield a 1 ns 
delay. An on-chip pulse measurement circuit was also fabricated to characterize the SET pulse 
widths [9]. The latches were exposed to Argon, Copper and Xenon ions at 0° and 60° and to Gold 
at 60° using the heavy-ion facilities at TAMU. The resulting LET values were calculated to be 
8.3, 16.6, 19.6, 39.2, 51.5, 103, and 170 MeV/mg/cm 2 . 


III. EXPERIMENTAL RESULTS 

Raw SEU data from the 
heavy ion test is shown in Figure 
5. A subset of SET pulse width 
data is shown in Figure 6. These 
data show that there were few 
SETs longer than 1 ns below an 
LET of 50 MeV/mg/cm 2 . This 
resulted in multiple upsets for the 
unprotected design, very few 
upsets for 1 guard-gate based 
design, and no upsets for the 
remaining two latch designs. At 
LETs of 51.5 and 103 
MeV/mg/cm 2 , about half the SETs 
are below Ins (from Figure 7), 
which agrees well with the error 
rates of the 1 guard-gate and 3 
guard-gate flip-flops being 
around half of that for the 
unprotected design. However, 
at higher LET values, the 1 
guard-gate design becomes 
worse than the unprotected 
design. This rate of increase in 
the number of upsets is 
explained in the following 
section. For LET values at 
which the SET pulse width was 



Figure 5: Heavy ion test results for 4 flip flop types and 
nroiections for a 5 th tvne (2ns TAG). 
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Figure 6: SET pulse width spectra from on-chip measurement 

circuit. 


more than 1 ns, the upset rate for unprotected and 3 guard-gate designs increased at similar rates. 
The upset rate for 4 guard-gate based DICE latch remains extremely low even at very high 
LET’S. 

Note that for LET of 103 and 170 the largest numbers of SETs are right around 1 ns, so in 
retrospect the Ins delay appears to have been a poor choice. A predicted curve for a 3-TAG latch 
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with a 2ns delay (labeled “2nsTAG est.” in Fig. 5) was derived by computing the ratio of 3-TAG 
hits to number of measured SET pulses greater than 1 ns at each LET, and multiplying this ratio 
times the number of measured SET pulses greater than 2ns at each LET. If the guarded delays 
are functioning as expected, an actual 2ns flip-flop should follow closely this predicted curve. 

Weibull curves were generated and MTBF for Low Earth Orbit (LEO) and 
geosynchronous (GEO) environments were calculated by the methods described used previously 
[Shuler] and are shown in Figure 7 and Table 1. 



D - unprotected 
■ - 1 TAG 
o - a TAG 
O - 4 TAG 
+ - 3ns TAG 


LET /m$ 


DEVICE MTBF (YEARS) / 1 000 FLIP-FLOPS 



LEO 

GEO 

UNPROTECTED 

0.2610 

0.0190 

1 TAG 

0.8320 

0.0620 

3 TAG 

1.7172 

0.0938 

4 TAG 

N/A 

N/A 

2ns TAG 

1583.8 

79.82 


Table 1: On-orbit MTBF for each device type. 


Figure 7: Weibull curves for each device type. 


IV. SIMULATIONS AND ANALYSIS 

To see if guarded delays are functioning as expected, we turn our attention to the 
anomalous behavior of the 1-TAG flip flop at high LET using simulations carried out with the 
Cadence Spectre® tool suite. SE hits were modeled using double-exponential current sources at 
the hit node. Multiple hits were modeled by using multiple current sources. Every single node in 
all four latch design was hit and the resulting SET pulse along with the upset/no upset ratio of the 
nodes was observed. 

The unprotected design 
showed the most vulnerability at low 
LET values as expected. In the 1 
guard-gate design, all SET pulses 
with less than 1 ns duration did not 
cause an upset. However, some of the 
multiple-node hits that arrived at the 
guard-gate consolidating such that the 
overall pulse width as seen by the 
guard-gate was more than 1 ns, caused 
an upset even though each individual 
SET pulse width was less than 1 ns. 

Such cases will result in an upset for 
LET lower than 51.5 MeV/mg/cm 2 . 

Also, for the 1 guard-gate design, the 
vulnerable area to a SE increases to a higher value than all other designs as a function of 
deposited charge (Qc) as shown in Figure 9. With the increase in number of vulnerable nodes, 
the increase in associated diffusion area for each node results in higher upset cross-section as 
evidenced by the experimental data. 

A partial explanation of this is that the first two parallel guard gates in the 3 -TAG design 
constitute a self-protected dual rail inverter stage, whereas the corresponding stage in the 1-TAG 
design depends on the guarded delay to eliminate SETs that originate in it. However, this does 
not explain all of the rise in vulnerable drain area, so questions remain about the efficacy of a 


Drain Area Cross-section vs Charge Deposited 



Figure 9: Vulnerable drain area cross-section as a function 


single guard-gate used in conjunction with a compact delay. When single nodes at the inputs of 
guard-gates are vulnerable, as they showed to be in this case, something is draining off or 
disturbing the state holding charge at the output node of the guard gate. 

Simulation results on 3 guard-gate design show the number of vulnerable nodes at high 
Qc to be only half that of the 1 guard-gate design. The total diffusion area that is vulnerable to 
high LET particles is still lesser than that for the unprotected and 1 guard-gate design. As a 
result, the number of upsets for this design remains lower than the unprotected and 1 guard-gate 
designs. However, pulses longer than 1.2 ns do cause an upset. As with the 1 guard-gate case, 
concatenated multiple SET pulses may result in an upset for this design. We assume that the 
primary reason for the difference in performance of 1-TAG and 3-TAG designs is the slightly 
longer total loop delay in the 3 -TAG. 

The 4 guard-gate based DICE design does not show any vulnerability in simulations 
even for moderate values of Qc and multiple node hits and hence have not been plotted. 
Simulation results showed upsets only when multiple nodes collected very high Qc. This is 
validated through the experimental data obtained where only one upset was observed at an LET 
of 170 MeV/mg/cm 2 . 

The 4-TAG data there may also be some advantage in the 3 -TAG design since one 
inverter stage in the flip-flop feedback loop is effectively a dual rail cross coupled pair of guard 
gates. This suggests the possibility of re-configuring the 1-TAG design to maximize the amount 
of loop stages that are in dual rail configuration, protected by the guard gate. 

VI. CONCLUSION 

We conclude that for highest speed and reliability in deep submicron designs, dual rail 
logic with storage cells such as the 4-TAG (or enhanced guard-gate DICE) latch will provide 
lower area and power than TMR designs, and that delay based designs will lag in clocking 
performance and SEU/SET tolerance. While it has been argued dual rail logic is not easily 
integrated into existing design tool flows, neither is TMR. If embedded in the fabric of a field 
programmable gate array (FPGA) dual rail implementation would be of concern only to the 
FPGA development not to application development, and unlike add-on TMR tools would protect 
both configuration logic and application logic while consuming fewer resources. 

For low power high density designs, variations of guarded delay design techniques 
remain viable with some caveats. First, our data show the length of SETs cannot be estimated by 
the popular approximation that SETs are about as long as the longest inter- stage propagation 
delay. In our case, a 2 ns SET is about three times as long as the maximum inter-stage 
propagation delay in 0.35pm CMOS. SET length should be directly measured for the target 
process by a technique such as the one we used. If the upset rate for a particular delay value of 
the subject delay based technique is known, then the upset rate for other delay values can be 
estimated from the SET spectra as we have done above, and a delay design value chosen to 
provide the desired MTBF in the target environment. 
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